Noise

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Okay, so he doesn’t use that term. But he explains how a magician’s inherent ability to detect deception can be useful to science.

We can’t make magicians out of scientists — we wouldn’t want to — but we can help scientists “think in the groove” — think like a magician. And we should.

We are not scientists — with a few rare but important exceptions, like Ray Hyman and Richard Wiseman. But our highly specific expertise comes from knowledge of the ways in which our audiences can be led to quite false conclusions by calculated means ­ psychological, physical and especially sensory, visual being rather paramount since it has such a range of variety.

The fact that ours is a concealed art as well as one designed to confound persons of average and advanced thinking skills — our typical audience — makes it rather immune to ordinary analysis or solutions.

I’ve observed that scientists tend to think and perceive logically by using their training and observational skills — of course — and are thus often psychologically insulated from the possibility that there might be chicanery at work. This is where magicians can come in. No matter how well educated, or how basically intelligent, trained, or observant a scientist may be, s/he may be a poor judge of a methodology employed in deliberate deception.

Here’s my essay on the security mindset.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Good article.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

This is the most intelligent thing I’ve read about the JetBlue incident where a pilot had a mental breakdown in the cockpit:

For decades, public safety officials and those who fund them have focused on training and equipment that has a dual-use function for any hazard that may come our way. The post-9/11 focus on terrorism, with all the gizmos that were bought in its name, was a moment of frenzy, and sometimes inconsistent with sound public policy. Over time, there was a return to security measures that were adaptable (dual or multiple use) to any threat and more sustainable in a world that has its fair share of both predictable and utterly bizarre events.

The mental condition of airline pilots is a relevant factor in their annual or bi-annual physicals. (FAA rules differ on the number of physicals required, based on the type of plane being flown.) But believing that the system is flawed because it didn’t predict the breakdown of one of 450,000 certified pilots is a myopic reaction.

In many ways, though, this kind of incident was anticipated. The system envisions pilot incapacitation — physical, mental, or possibly, as in the campy movie ”Snakes on a Plane,” a slithering foe.

That is, after all, why we have copilots.

The whole essay is worth reading.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Good article on the current battle for Internet governance:

The War for the Internet was inevitable — a time bomb built into its creation. The war grows out of tensions that came to a head as the Internet grew to serve populations far beyond those for which it was designed. Originally built to supplement the analog interactions among American soldiers and scientists who knew one another off-line, the Internet was established on a bedrock of trust: trust that people were who they said they were, and trust that information would be handled according to existing social and legal norms. That foundation of trust crumbled as the Internet expanded. The system is now approaching a state of crisis on four main fronts.

The first is sovereignty: by definition, a boundary-less system flouts geography and challenges the power of nation-states. The second is piracy and intellectual property: information wants to be free, as the hoary saying goes, but rights-holders want to be paid and protected. The third is privacy: online anonymity allows for creativity and political dissent, but it also gives cover to disruptive and criminal behavior — and much of what Internet users believe they do anonymously online can be tracked and tied to people’s real-world identities. The fourth is security: free access to an open Internet makes users vulnerable to various kinds of hacking, including corporate and government espionage, personal surveillance, the hijacking of Web traffic, and remote manipulation of computer-controlled military and industrial processes.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Symantec deliberately “lost” a bunch of smart phones with tracking software on them, just to see what would happen:

Some 43 percent of finders clicked on an app labeled “online banking.” And 53 percent clicked on a filed named “HR salaries.” A file named “saved passwords” was opened by 57 percent of finders. Social networking tools and personal e-mail were checked by 60 percent. And a folder labeled “private photos” tempted 72 percent.

Collectively, 89 percent of finders clicked on something they probably shouldn’t have.

Meanwhile, only 50 percent of finders offered to return the gadgets, even though the owner’s name was listed clearly within the contacts file.

[...]

Some might consider the 50 percent return rate a victory for humanity, but that wasn’t really the point of Symantec’s project. The firm wanted to see if — even among what seem to be honest people — the urge to peek into someone’s personal data was just too strong to resist. It was.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Turns out the password can be easily bypassed:

XRY works by first jailbreaking the handset. According to Micro Systemation, no ‘backdoors’ created by Apple used, but instead it makes use of security flaws in the operating system the same way that regular jailbreakers do.

Once the iPhone has been jailbroken, the tool then goes on to ‘brute-force’ the passcode, trying every possible four digit combination until the correct password has been found. Given the limited number of possible combinations for a four-digit passcode — 10,000, ranging from 0000 to 9999 — this doesn’t take long.

Once the handset has been jailbroken and the passcode guessed, all the data on the handset, including call logs, messages, contacts, GPS data and even keystrokes, can be accessed and examined.

One of the morals is to use an eight-digit passcode.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Paul Ceglia’s lawsuit against Facebook is fascinating, but that’s not the point of this blog post. As part of the case, there are allegations that documents and e-mails have been electronically forged. I found this story about the forensics done on Ceglia’s computer to be interesting.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

This article talks about legitimate companies buying zero-day exploits, including the fact that “an undisclosed U.S. government contractor recently paid $250,000 for an iOS exploit.”

The price goes up if the hack is exclusive, works on the latest version of the software, and is unknown to the developer of that particular software. Also, more popular software results in a higher payout. Sometimes, the money is paid in instalments, which keep coming as long as the hack does not get patched by the original software developer.

Yes, I know that vendors will pay bounties for exploits. And I’m sure there are a lot of government agencies around the world who want zero-day exploits for both espionage and cyber-weapons. But I just don’t see that much value in buying an exploit from random hackers around the world.

These things only have value until they’re patched, and a known exploit — even if it is just known by the seller — is much more likely to get patched. I can much more easily see a criminal organization deciding that the exploit has significant value before that happens. Government agencies are playing a much longer game.

And I would expect that most governments have their own hackers who are finding their own exploits. One, cheaper. And two, only known within that government.

Here’s another story, with a price list for different exploits. But I still don’t trust this story.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Interesting research:

The squid use two closely spaced organs called statocysts to sense sound.

“I think of a statocyst as an inside-out tennis ball,” explains Dr Mooney.

“It’s got hairs on the inside and this little dense calcium stone that sits on those hair cells.

“What happens is that the sound wave actually moves the squid back and forth, and this dense object stays relatively still. It bends the hair cells and generates a nerve response to the brain.”

[...]

“They react in about 10 milliseconds,” he says. “That’s really fast; it’s essentially a reflex. That’s really important in terms of behavioural responses because they’re not thinking about processing it; they’re not deciding whether they should react — they’re just doing it.

And he adds: “The responses can be really dynamic. They can be a change in colour; they can be jetting (moving quickly) or inking responses. Squid are also very cool because you can look at a range of colour changes — is it a really startling colour change or a more subtle change?

“Squid can probably use their hearing to find their way around the environment — to sense the soundscape of the environment; for example, to find their way towards a reef or away from a reef, towards the surface or away from the surface.”

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Normally I just delete these as spam, but this summer program for graduate students 1) looks interesting, and 2) has some scholarship money available.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

As I posted previously, I have been debating former TSA Administrator Kip Hawley on the Economist website. I didn’t bother reposting my opening statement and rebuttal, because — even though I thought I did a really good job with them — they were largely things I’ve said before. In my closing statement, I talked about specific harms post-9/11 airport security has caused. This is mostly new, so here it is, British spelling and punctuation and all.

In my previous two statements, I made two basic arguments about post-9/11 airport security. One, we are not doing the right things: the focus on airports at the expense of the broader threat is not making us safer. And two, the things we are doing are wrong: the specific security measures put in place since 9/11 do not work. Kip Hawley doesn’t argue with the specifics of my criticisms, but instead provides anecdotes and asks us to trust that airport security—and the Transportation Security Administration (TSA) in particular—knows what it’s doing.

He wants us to trust that a 400-ml bottle of liquid is dangerous, but transferring it to four 100-ml bottles magically makes it safe. He wants us to trust that the butter knives given to first-class passengers are nevertheless too dangerous to be taken through a security checkpoint. He wants us to trust the no-fly list: 21,000 people so dangerous they’re not allowed to fly, yet so innocent they can’t be arrested. He wants us to trust that the deployment of expensive full-body scanners has nothing to do with the fact that the former secretary of homeland security, Michael Chertoff, lobbies for one of the companies that makes them. He wants us to trust that there’s a reason to confiscate a cupcake (Las Vegas), a 3-inch plastic toy gun (London Gatwick), a purse with an embroidered gun on it (Norfolk, VA), a T-shirt with a picture of a gun on it (London Heathrow) and a plastic lightsaber that’s really a flashlight with a long cone on top (Dallas/Fort Worth).

At this point, we don’t trust America’s TSA, Britain’s Department for Transport, or airport security in general. We don’t believe they’re acting in the best interests of passengers. We suspect their actions are the result of politicians and government appointees making decisions based on their concerns about the security of their own careers if they don’t act tough on terror, and capitulating to public demands that “something must be done”.

In this final statement, I promised to discuss the broader societal harms of post-9/11 airport security. This loss of trust—in both airport security and counterterrorism policies in general—is the first harm. Trust is fundamental to society. There is an enormous amount written about this; high-trust societies are simply happier and more prosperous than low-trust societies. Trust is essential for both free markets and democracy. This is why open-government laws are so important; trust requires government transparency. The secret policies implemented by airport security harm society because of their very secrecy.

The humiliation, the dehumanisation and the privacy violations are also harms. That Mr Hawley dismisses these as mere “costs in convenience” demonstrates how out-of-touch the TSA is from the people it claims to be protecting. Additionally, there’s actual physical harm: the radiation from full-body scanners still not publicly tested for safety; and the mental harm suffered by both abuse survivors and children: the things screeners tell them as they touch their bodies are uncomfortably similar to what child molesters say.

In 2004, the average extra waiting time due to TSA procedures was 19.5 minutes per person. That’s a total economic loss—in –America—of $10 billion per year, more than the TSA’s entire budget. The increased automobile deaths due to people deciding to drive instead of fly is 500 per year. Both of these numbers are for America only, and by themselves demonstrate that post-9/11 airport security has done more harm than good.

The current TSA measures create an even greater harm: loss of liberty. Airports are effectively rights-free zones. Security officers have enormous power over you as a passenger. You have limited rights to refuse a search. Your possessions can be confiscated. You cannot make jokes, or wear clothing, that airport security does not approve of. You cannot travel anonymously. (Remember when we would mock Soviet-style “show me your papers” societies? That we’ve become inured to the very practice is a harm.) And if you’re on a certain secret list, you cannot fly, and you enter a Kafkaesque world where you cannot face your accuser, protest your innocence, clear your name, or even get confirmation from the government that someone, somewhere, has judged you guilty. These police powers would be illegal anywhere but in an airport, and we are all harmed—individually and collectively—by their existence.

In his first statement, Mr Hawley related a quote predicting “blood running in the aisles” if small scissors and tools were allowed on planes. That was said by Corey Caldwell, an Association of Flight Attendants spokesman, in 2005. It was not the statement of someone who is thinking rationally about airport security; it was the voice of irrational fear.

Increased fear is the final harm, and its effects are both emotional and physical. By sowing mistrust, by stripping us of our privacy—and in many cases our dignity—by taking away our rights, by subjecting us to arbitrary and irrational rules, and by constantly reminding us that this is the only thing between us and death by the hands of terrorists, the TSA and its ilk are sowing fear. And by doing so, they are playing directly into the terrorists’ hands.

The goal of terrorism is not to crash planes, or even to kill people; the goal of terrorism is to cause terror. Liquid bombs, PETN, planes as missiles: these are all tactics designed to cause terror by killing innocents. But terrorists can only do so much. They cannot take away our freedoms. They cannot reduce our liberties. They cannot, by themselves, cause that much terror. It’s our reaction to terrorism that determines whether or not their actions are ultimately successful. That we allow governments to do these things to us—to effectively do the terrorists’ job for them—is the greatest harm of all.

Return airport security checkpoints to pre-9/11 levels. Get rid of everything that isn’t needed to protect against random amateur terrorists and won’t work against professional al-Qaeda plots. Take the savings thus earned and invest them in investigation, intelligence, and emergency response: security outside the airport, security that does not require us to play guessing games about plots. Recognise that 100% safety is impossible, and also that terrorism is not an “existential threat” to our way of life. Respond to terrorism not with fear but with indomitability. Refuse to be terrorized.

EDITED TO ADD (3/20): Cory Doctorow on the exchange:

All of Hawley’s best arguments sum up to “Someone somewhere did something bad, and if he’d tried it on us, we would have caught him.” His closing clincher? They heard a bad guy was getting on a plane somewhere. The figured out which plane, stopped it from taking off and “resolved” the situation. Seeing as there were no recent reports of foiled terrorist plots, I’m guessing the “resolution” was “it turned out we made a mistake.” But Hawley’s takeaway is: “look at how fast our mistake was!”

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Last weekend was the 2012 SHARCS (Special-Purpose Hardware for Attacking Cryptographic Systems) conference. The presentations are online.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

“Empirical Analysis of Data Breach Litigation,” Sasha Romanosky, David Hoffman, and Alessandro Acquisti:

Abstract: In recent years, a large number of data breaches have resulted in lawsuits in which individuals seek redress for alleged harm resulting from an organization losing or compromising their personal information. Currently, however, very little is known about those lawsuits. Which types of breaches are litigated, which are not? Which lawsuits settle, or are dismissed? Using a unique database of manually-collected lawsuits from PACER, we analyze the court dockets of over 230 federal data breach lawsuits from 2000 to 2010. We use binary outcome regressions to investigate two research questions: Which data breaches are being litigated in federal court? Which data breach lawsuits are settling? Our results suggest that the odds of a firm being sued in federal court are 3.5 times greater when individuals suffer financial harm, but over 6 times lower when the firm provides free credit monitoring following the breach. We also find that defendants settle 30% more often when plaintiffs allege financial loss from a data breach, or when faced with a certified class action suit. While the compromise of financial information appears to lead to more federal litigation, it does not seem to increase a plaintiff’s chance of a settlement. Instead, compromise of medical information is more strongly correlated with settlement.

The full paper is available by using the one-click download button.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

I was supposed to testify today about the TSA in front of the House Committee on Oversight and Government Reform. I was informally invited a couple of weeks ago, and formally invited last Tuesday:

The hearing will examine the successes and challenges associated with Advanced Imaging Technology (AIT), the Screening of Passengers by Observation Techniques (SPOT) program, the Transportation Worker Credential Card (TWIC), and other security initiatives administered by the TSA.

On Friday, at the request of the TSA, I was removed from the witness list. The excuse was that I am involved in a lawsuit against the TSA, trying to get them to suspend their full-body scanner program. But it’s pretty clear that the TSA is afraid of public testimony on the topic, and especially of being challenged in front of Congress. They want to control the story, and it’s easier for them to do that if I’m not sitting next to them pointing out all the holes in their position. Unfortunately, the committee went along with them. (They tried to pull the same thing last year and it failed — video at the 10:50 mark.)

The committee said it would try to invite me back for another hearing, but with my busy schedule, I don’t know if I will be able to make it. And it would be far less effective for me to testify without forcing the TSA to respond to my points.

I’m there in spirit, though. The title of the hearing is “TSA Oversight Part III: Effective Security or Security Theater?”

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

This is a neat story:

A pair of rare Enigma machines used in the Spanish Civil War have been given to the head of GCHQ, Britain’s communications intelligence agency. The machines – only recently discovered in Spain – fill in a missing chapter in the history of British code-breaking, paving the way for crucial successes in World War II.

Fun paragraphs:

A non-commissioned officer found the machines almost by chance, only a few years ago, in a secret room at the Spanish Ministry of Defence in Madrid.

“Nobody entered there because it was very secret,” says Felix Sanz, the director of Spain’s intelligence service.

“And one day somebody said ‘Well if it is so secret, perhaps there is something secret inside.’ They entered and saw a small office where all the encryption was produced during not only the civil war but in the years right afterwards.”

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

It seems that the huge eyes of the giant squid are optimized to see sperm whales.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

On The Economist website, I am currently debating Kip Hawley on airplane security. On Tuesday we posted our initial statements, and today (London time) we posted our rebuttals. We have one more round to go.

I’ve set it up to talk about the myriad of harms airport security has caused: loss of trust in government, increased fear, creeping police state, loss of liberty in the “rights free zone,” and so on. Suggestions of what to say next are appreciated.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

In an excellent article in Wired, James Bamford talks about the NSA’s codebreaking capability.

According to another top official also involved with the program, the NSA made an enormous breakthrough several years ago in its ability to cryptanalyze, or break, unfathomably complex encryption systems employed by not only governments around the world but also many average computer users in the US. The upshot, according to this official: “Everybody’s a target; everybody with communication is a target.”

Bamford has been writing about the NSA for decades, and people tell him all sorts of confidential things. Reading the above, the obvious question to ask is: can the NSA break AES?

My guess is that they can’t. That is, they don’t have a cryptanalytic attack against the AES algorithm that allows them to recover a key from known or chosen ciphertext with a reasonable time and memory complexity. I believe that what the “top official” was referring to is attacks that focus on the implementation and bypass the encryption algorithm: side-channel attacks, attacks against the key generation systems (either exploiting bad random number generators or sloppy password creation habits), attacks that target the endpoints of the communication system and not the wire, attacks that exploit key leakage, attacks against buggy implementations of the algorithm, and so on. These attacks are likely to be much more effective against computer encryption.

EDITED TO ADD (3/22): Another option is that the NSA has built dedicated hardware capable of factoring 1024-bit numbers. There’s quite a lot of RSA-1024 out there, so that would be a fruitful project. So, maybe.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

IT World published an excerpt from Chapter 4.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

A way to securely erase paper:

“The key idea was to find a laser energy level that is high enough to ablate – or vaporise – the toner that at the same time is lower than the destruction threshold of the paper substrate. It turns out the best wavelength is 532 nanometres – that’s green visible light – with a pulse length of 4 nanoseconds, which is quite long,” Leal-Ayala told New Scientist.

“We have repeated the printing/unprinting process three times on the same piece of paper with good results. The more you do it, though, the more likely it is for the laser to damage the paper, perhaps yellowing it,” he says. The team have found toner-paper combinations in which almost no appreciable traces of toner can be seen after lasing and in which the paper suffers “no significant mechanical damage.”

EDITED TO ADD (3/21): More than one reader has pointed out that this system is not secure, nor do its inventors make any claims of security.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

A otherwise uninteresting article on Internet threats to public infrastructure contains this paragraph:

At a closed-door briefing, the senators were shown how a power company employee could derail the New York City electrical grid by clicking on an e-mail attachment sent by a hacker, and how an attack during a heat wave could have a cascading impact that would lead to deaths and cost the nation billions of dollars.

Why isn’t the obvious solution to this to take those critical electrical grid computers off the public Internet?

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Avi Rubin has a TEDx talk on hacking various computer devices: medical devices, automobiles, police radios, smart phones, etc.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

I like the quote at the end of this excerpt:

Aviation officials have questioned the need for such a strong permanent police presence at airports, suggesting they were there simply “to make the government look tough on terror”.

One senior executive said in his experience, the officers were expensive window-dressing.

“When you add the body scanners, the ritual humiliation of old ladies with knitting needles and the farcical air marshals, it all adds up to billions of dollars to prevent what? A politician being called soft on terror, that’s what,” he said.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

It looks great.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Jon Callas talks about BitCoin’s security model, and how susceptible it would be to a Goldfinger-style attack (destroy everyone else’s BitCoins).